Potential Persistence Attempt Via Existing Service Tampering — Detection Rule
Detects the modification of an existing service in order to execute an arbitrary payload when the service is started or killed as a potential method for persistence.
Detects the modification of an existing service in order to execute an arbitrary payload when the service is started or killed as a potential method for persistence.